Avoid concatenating non literals in a StringBuffer constructor or append().
